frontpage.
newsnewestaskshowjobs

Made with ♥ by @iamnishanth

Open Source @Github

fp.

Open in hackernews

Cloudflare targets 2029 for full post-quantum security

https://blog.cloudflare.com/post-quantum-roadmap/
86•ilreb•2h ago

Comments

ls612•1h ago
The secrecy around this is precisely the opposite of what we saw in the 90s when it started to become clear DES needed to go. Yet another sign that the global powers are preparing for war.
NitpickLawyer•1h ago
My read of the recent google blog post is that they framed it as cryptocurrency related stuff just so they don't say the silent thing out loud. But lots of people "in the know" / working on this are taking it much more seriously than just cryptobros go broke. So my hunch is that there's more to it and they didn't want to say it / couldn't / weren't allowed to.
IncreasePosts•1h ago
What is "it" that you're referring to?
wil421•1h ago
> mitigating harvest-now/decrypt-later attacks.

Most likely the NSA or someone else is ahead of the game and already has a quantum computer. If the tech news rumors are to true the NSA has a facility in Utah that can gather large swaths of the internet and process the data.

adrian_b•1h ago
It should be noted that quantum computers are a threat mainly for interactions between unrelated parties which perform legal activities, e.g. online shopping, online banking, notarized legal documents that use long-term digital signatures.

Quantum computers are not a threat for spies or for communications within private organizations where security is considered very important, where the use of public-key cryptography can easily be completely avoided and authentication and session key exchanges can be handled with pre-shared secret keys used only for that purpose.

tptacek•1h ago
What do you mean? For as long as I remember (back to late 1994) people understood DES to be inadequate; we used DES-EDE and IDEA (and later RC4) instead. What "secrecy" would there have been? The feasibility of breaking DES given a plausible budget goes all the way back to the late 1970s. The first prize given for demonstrating a DES break was only $10,000.
adrian_b•1h ago
Triple-key DES (DES-EDE) had already been proposed by IBM in 1979, in response to the criticism that the 56-bit keys of DES are far too short.

So practically immediately after DES was standardized, people realized that NSA had crippled it by limiting the key length to 56 bits, and they started to use workarounds.

Before introducing RC2 and RC4 in 1987, Ronald Rivest had used since 1984 another method of extending the key length of DES, named DESX, which was cheaper than DES-EDE as it used a single block cipher function invocation. However, like also RC4, DESX was kept as a RSA trade secret, until it was leaked, also like RC4, during the mid nineties.

IDEA (1992, after a preliminary version was published in 1991) was the first block cipher function that was more secure than DES and which was also publicly described.

heliumtera•1h ago
And that changes what?
ezfe•1h ago
It would mean that they're future-proofing their security
bwesterb•1h ago
If we do our job, it changes nothing. Problem with security generally: no spectacle if it's all correct. :)
Bender•1h ago
Is this still theory or are there working Quantum systems that have broken anything yet?
moi2388•1h ago
Theory. And afaik there are still questions as to if the PQ algorithms are actually secure.
sophacles•43m ago
tbf - since we still don't know if p != np, there are still questions about if the current algorithms are secure also.
moi2388•19m ago
Fair, but recently several PQ algorithms have been shown to in fact not be secure, with known attacks, so I wouldn’t equate them
sophacles•13m ago
Intersting. I'd like to learn more about this - where can I find info about it?
PUSH_AX•42m ago
Nothing has been broken yet, however data can be collected now and be cracked when the time comes, hence why there is a push.
OkayPhysicist•27m ago
It's theory. The concern is for avoiding a (likely, IMO) scenario where the only real indication that someone cracked QC is one or more teams of researchers in the field going dark because they got pulled into some tight-lipped NSA project. If we wait until we have an unambiguous path to QC, it might well be too late.

To avoid the scenario where for a prolonged period of time the intelligence community has secret access to QC, researchers against that type of thing are incentivized to shout fire when they see the glimmerings of a possibly productive path of research.

tptacek•7m ago
Among cryptography engineers there was a sharp vibe shift over the last 2 months; there are papers supporting that vibe shift, but there's also a rumor mill behind it too. The field has basically aligned fully in a way it hadn't before that this is an urgent concern. The simplest way to put it is that everyone's timeline for a real-world CRQC has shortened. Not everyone has the same timeline, but all those timelines are now shorter, and for some important (based on industry and academic position) practitioners, it's down to "imminent".
20k•1h ago
Quantum computing, and the generic term 'quantum' is gearing up to be the next speculative investment hype bubble after AI, so prepare for a lot of these kinds of articles
bwesterb•1h ago
At least it's time bound: hope to have this job done by 2029!
Hasz•41m ago
nah. governments around the world are hoovering up traffic today with the hope of a "cheap" (by nation state standards) quantum computer. Some of the secrets sent today are "evergreen" (i.e are still relevant 10+ years into the future), amongst a whole lot of cruft. There is massive incentive to hide the technology to keep your peers transmitting in vulnerable encryption as long as possible.
nickspacek•25m ago
For sure, that or just ensuring they have laws in place that grant them access to the unencrypted data we are sending to CDNs operating in their jurisdiction (when necessary for national security reasons).
cetinsert•55m ago
You can do PQ queries with us at qi.rt.ht!

Which one do you think is PQ-secure?

https://qi.rt.ht/?pq={api.,}{stripe,paypal}.com

1a527dd5•12m ago
That is a beautiful api.
hackerman70000•47m ago
Cloudflare pushing PQ by default is probably the single most impactful thing that can happen for adotpion. Most developers will never voluntarily migrate their TLS config. Making it the default at the CDN layer means millions of sites get upgraded without anyone making a decision
jgrahamc•39m ago
Cloudflare has long been doing work on PQ (sometimes in conjunction with Google) and rolled out PQ encryption for our customers. You can read about where this all started for us 7 years back: https://blog.cloudflare.com/towards-post-quantum-cryptograph... and four years ago rolled out PQ encryption for all customers: https://blog.cloudflare.com/post-quantum-for-all/

The big change here is that we're going to roll out PQ authentication as well.

One important decision was to make this "included at no extra cost" with every plan. The last thing the Internet needs is blood-sucking parasites charging extra for this.

rdl•44m ago
It will be interesting to compare PQ rollout to HTTPS rollout historically (either the "SSL becomes widespread in 2015" thing, or the deprecation SSL 3.0). Cloudflare is in an easy position to do stuff like this because it can decouple end user/browser upgrade cycles from backend upgrade cycles.

Some browsers and some end user devices get upgraded quickly, so making it easy to make it optionally-PQ on any site, and then as that rollout extends, some specialty sites can make it mandatory, and then browser/device UX can do soft warnings to users (or other activity like downranking), and then at some point something like STS Strict can be exposed, and then largely become a default (and maybe just remove the non-PQ algorithms entirely from many sites).

I definitely was on team "the risks of a rushed upgrade might outweigh the risks of actual quantum breaks" until pretty recently -- rushing to upgrade has lots of problems always and is a great way to introduce new bugs, but based on the latest information, the balance seems to have shifted to doing an upgrade quickly.

Updating websites is going to be so much easier than dealing with other systems (bitcoin probably the worst; data at rest storage systems; hardware).

stingraycharles•36m ago
> Updating websites is going to be so much easier than dealing with other systems (bitcoin probably the worst; data at rest storage systems; hardware).

IPv6 deserves a prominent spot there

bwesterb•23m ago
Waiting now means rushing even more close to the deadline! We added stats on origin support for post-quantum encryption. Not as much support as browsers of course, but better than I expected. Still a long road (and authentication!). https://radar.cloudflare.com/post-quantum
jeroenhd•20m ago
If any kind of proof about serious quantum computers comes to light, browsers can force most websites' hand by marking non-PQ ciphers as insecure.

Maybe it'll require TLS 1.4/QUIC 2, with no changes but the cipher specifications, but it can happen in two or three years. Certificates themselves don't last longer than a year anyway. Corporations running ancient software that doesn't support PQ TLS will have the same configuration options to ignore the security warnings already present for TLS 1.0/plain HTTP connections.

The biggest problem I can imagine is devices talking to the internet no longer receiving firmware updates. If the web host switches protocols, the old clients will start dying off en masses.

bwesterb•16m ago
No need for a TLS 1.4.

Leaf certificates don't last long, but root CAs do. An attacker can just mint new certs from a broken root key.

Hopefully many devices can be upgraded to PQ security with a firmware update. Worse than not receiving updates, is receiving malicious firmware updates, which you can't really prevent without upgrading to something safe first.

valeriozen•38m ago
cloudflare making pq the default is the only way we get real adoption. most devs are never going to mess with their tls settings unless they absolutely have to. having it happen at the cdn level is the perfect silent upgrade for millions of sites without the owners needing to do anything

Show HN: Brutalist Concrete Laptop Stand (2024)

https://sam-burns.com/posts/concrete-laptop-stand/
464•sam-bee•5h ago•162 comments

Cloudflare targets 2029 for full post-quantum security

https://blog.cloudflare.com/post-quantum-roadmap/
88•ilreb•2h ago•32 comments

Moving fast in hardware: lessons from lab to $100M ARR

https://blog.zacka.io/p/simplify-then-add-lightness-bc4
44•rryan•1h ago•9 comments

Google open-sources experimental agent orchestration testbed Scion

https://www.infoq.com/news/2026/04/google-agent-testbed-scion/
25•timbilt•3h ago•4 comments

We found an undocumented bug in the Apollo 11 guidance computer code

https://www.juxt.pro/blog/a-bug-on-the-dark-side-of-the-moon/
292•henrygarner•6h ago•153 comments

Dropping Cloudflare for Bunny.net

https://jola.dev/posts/dropping-cloudflare
257•shintoist•3h ago•119 comments

12k Tons of Dumped Orange Peel Grew into a Landscape Nobody Expected (2017)

https://www.sciencealert.com/how-12-000-tonnes-of-dumped-orange-peel-produced-something-nobody-im...
74•pulisse•1h ago•12 comments

Show HN: A cartographer's attempt to realistically map Tolkien's world

https://www.intofarlands.com/atlasofarda
104•intofarlands•4h ago•18 comments

Every GPU That Mattered

https://sheets.works/data-viz/every-gpu
252•jonbaer•8h ago•138 comments

Show HN: Finalrun – Spec-driven testing using English and vision for mobile apps

https://github.com/final-run/finalrun-agent
8•ashish004•2h ago•2 comments

You can't cancel a JavaScript promise (except sometimes you can)

https://www.inngest.com/blog/hanging-promises-for-control-flow
49•goodoldneon•3h ago•31 comments

9 Mothers (YC P26) Is Hiring – Lead Robotics and More

https://jobs.ashbyhq.com/9-mothers?utm_source=x8pZ4B3P3Q
1•ukd1•3h ago

A new Postcrossing stamp from the USA

https://www.postcrossing.com/blog/2026/03/31/a-new-postcrossing-stamp-from-the-usa
15•Tomte•3d ago•4 comments

Identify a London Underground Line just by listening to it

https://tubesoundquiz.com/
142•nelson687•6h ago•43 comments

Good Taste the Only Real Moat Left

https://rajnandan.com/posts/taste-in-the-age-of-ai-and-llms/
68•speckx•1h ago•63 comments

GLM-5.1: Towards Long-Horizon Tasks

https://z.ai/blog/glm-5.1
4•zixuanlimit•24m ago•4 comments

Global Physics Photowalk: 2025 winners revealed

https://www.quantamagazine.org/global-physics-photowalk-2025-winners-revealed-20260401/
14•ibobev•4d ago•1 comments

SQLite in Production: Lessons from Running a Store on a Single File

https://ultrathink.art/blog/sqlite-in-production-lessons
94•thunderbong•3d ago•66 comments

My Experience as a Rice Farmer

https://xd009642.github.io/2026/04/01/My-Experience-as-a-Rice-Farmer.html
298•surprisetalk•5d ago•142 comments

Wi-Fi That Can Withstand a Nuclear Reactor: This receiver chip can take it

https://spectrum.ieee.org/robotics-in-nuclear-industry
63•voxadam•4d ago•3 comments

Haunting Photos Show the Aftermath of the Kursk Submarine Disaster in 2000

https://rarehistoricalphotos.com/kursk-submarine-disaster-photos/
109•mooreds•5d ago•27 comments

Blackholing My Email

https://www.johnsto.co.uk/blog/blackholing-my-email/
129•semyonsh•8h ago•16 comments

DeiMOS – A Superoptimizer for the MOS 6502

https://aransentin.github.io/deimos/
59•Aransentin•5h ago•15 comments

Claude Code is locking people out for hours

https://github.com/anthropics/claude-code/issues/44257
177•sh1mmer•1h ago•216 comments

Show HN: Stop paying for Dropbox/Google Drive, use your own S3 bucket instead

https://locker.dev
190•Zm44•5h ago•157 comments

Show HN: Pion/handoff – Move WebRTC out of browser and into Go

https://github.com/pion/handoff
72•Sean-Der•4h ago•11 comments

Breaking the console: a brief history of video game security

https://sergioprado.blog/breaking-the-console-a-brief-history-of-video-game-security/
71•sprado•7h ago•22 comments

AI may be making us think and write more alike

https://dornsife.usc.edu/news/stories/ai-may-be-making-us-think-and-write-more-alike/
182•giuliomagnifico•5h ago•182 comments

An AI robot in my home

https://allevato.me/2026/04/07/an-ai-robot-in-my-home
6•kukanani•3h ago•0 comments

Sam Altman may control our future – can he be trusted?

https://www.newyorker.com/magazine/2026/04/13/sam-altman-may-control-our-future-can-he-be-trusted
1824•adrianhon•1d ago•744 comments